Privacy notice

The short version

CineMention stores what you tell it and what you do with it — your account, your films, your writing, your connections. It runs no advertising, no analytics and no tracking of any kind, it sells nothing to anyone, and the only companies that touch your data are the three it is built on and the one the posters come from.

Your account

Signing in is handled by Clerk. They hold your email address, your password or the social account you signed in with, your username, your display name, your avatar and the devices you are signed in on. CineMention never sees your password, and it stores only the account id Clerk issues.

What the app stores about you

Everything below is keyed to that account id, in one database:

• Your profile — bio, location, website, the backdrop you chose, the links you added and your four favourite films.
• Your films — every log, rating, review, rewatch and watch date, plus what you have marked as watched, liked or on your watchlist, and the lists you build out of them.
• Your writing — posts, comments, debate arguments, blog articles and the drafts behind them, with the edit and delete times attached.
• Your people — who you follow, who follows you, who you have blocked, the clubs you belong to and the direct messages you have sent, which are readable by the people in the conversation and by nobody else.
• Persona — every swipe you make on the deck and the signals scored from it, your game plays and puzzle results, your prediction ballots, and your points, level and badges.
• Housekeeping — your notification settings, the notifications themselves, how far you have read your feed, and the push subscription your browser issues if you turn notifications on.
• What you send us — anything typed into the feedback box, and any report you file, with what it was about.

Images you attach to a post, a club or an article are uploaded to public storage and get a stable address. Anyone with that address can open the file, so treat an upload as public the moment it is made. Deleting the post deletes the file with it.

What is public by default

CineMention is a social app, so most of it is meant to be read. Profiles, reviews, ratings, posts, comments, debate arguments, club membership and follower counts are visible to anyone, signed in or not. A list is the exception — it carries its own public switch — and direct messages are never public. Everything else you would rather not publish is best not written here.

Cookies and what sits in your browser

The only cookies are Clerk’s, and they exist to keep you signed in. There are no analytics cookies, no advertising cookies and no third-party trackers.

Four things are kept in your own browser and never sent anywhere:

• cinemention:feed — where you had scrolled to, so the back button returns you there.
• cinemention:recent-posts — the posts you just looked at, so the feed stops repeating them.
• cinemention:push — whether you asked for notifications.
• cinemention:install-dismissed — that you closed the install prompt.

Clearing your browser data clears all four.

Who else your data reaches

• Clerk — accounts, sign-in and session cookies.
• Supabase — the database and the image storage behind everything in the list above.
• Vercel — hosting. Like any web host it records the requests it serves, including IP addresses.
• TMDB — posters and stills load straight from image.tmdb.org, so TMDB sees those image requests. Nothing about your account goes with them.
• Your browser’s push service — Apple, Google or Mozilla, depending on the browser, and only if you turn notifications on.
• YouTube and Vimeo — only when an article embeds a video, and YouTube only in its no-cookie form.

That is the whole list. Nothing is sold, and nothing is shared for advertising, because there is no advertising.

How long it is kept

Your account and everything attached to it stay until you ask for them to go. Reports and feedback are kept after that where they are still needed to moderate, because a report is about someone else as much as about you.

CineMention is in alpha, and the Terms of use say what that means here: data may be reset. Do not treat this as the only copy of anything you would miss.

How it is kept safe

Every table has row-level security switched on, so a read is checked against your account id in the database itself rather than only in the app in front of it. Traffic is HTTPS, the pages run under a content security policy that names every outside address the browser is allowed to reach, and credentials never leave Clerk.

None of that makes a system perfect. It is a small project run by fans, and it should be read as one.

What you can do about it

• See it — nearly all of it is on your own profile and in Settings. For the rest, ask.
• Change it — profile, favourites and links in Settings; email, password and devices in Settings under Account.
• Delete it — reviews, lists, posts and comments each delete where they live. For the account and everything on it at once, ask.
• Take it with you — there is no export yet. Ask and you will be sent what the app holds.

“Ask” means Contact, which is the feedback box. Depending on where you live you may also have a statutory right to object to processing or to complain to a data-protection authority; nothing here limits that.

Age, and where the data sits

You must be at least 16 to hold an account, and CineMention does not knowingly keep data about anyone younger. Clerk, Supabase and Vercel run infrastructure in several countries, so your data may be processed outside the one you are reading this in.

Changes, and getting in touch

This notice changes as the app does, and the date at the top says when it last did. Anything you want to ask about it goes through Contact.